{"action":"created","issue":{"url":"https://api.github.com/repos/cockpit-project/cockpit/issues/6025","repository_url":"https://api.github.com/repos/cockpit-project/cockpit","labels_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/6025/labels{/name}","comments_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/6025/comments","events_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/6025/events","html_url":"https://github.com/cockpit-project/cockpit/pull/6025","id":211737105,"number":6025,"title":"ws: Move to /etc/ssh/ssh_known_hosts","user":{"login":"martinpitt","id":200109,"avatar_url":"https://avatars0.githubusercontent.com/u/200109?v=3","gravatar_id":"","url":"https://api.github.com/users/martinpitt","html_url":"https://github.com/martinpitt","followers_url":"https://api.github.com/users/martinpitt/followers","following_url":"https://api.github.com/users/martinpitt/following{/other_user}","gists_url":"https://api.github.com/users/martinpitt/gists{/gist_id}","starred_url":"https://api.github.com/users/martinpitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinpitt/subscriptions","organizations_url":"https://api.github.com/users/martinpitt/orgs","repos_url":"https://api.github.com/users/martinpitt/repos","events_url":"https://api.github.com/users/martinpitt/events{/privacy}","received_events_url":"https://api.github.com/users/martinpitt/received_events","type":"User","site_admin":false},"labels":[{"id":88467047,"url":"https://api.github.com/repos/cockpit-project/cockpit/labels/needswork","name":"needswork","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-03-03T16:32:15Z","updated_at":"2017-03-06T09:57:17Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/cockpit-project/cockpit/pulls/6025","html_url":"https://github.com/cockpit-project/cockpit/pull/6025","diff_url":"https://github.com/cockpit-project/cockpit/pull/6025.diff","patch_url":"https://github.com/cockpit-project/cockpit/pull/6025.patch"},"body":"There is no real reason for maintaining our own \r\n/var/lib/cockpit/known_hosts file, as ssh itself already has a global\r\none in /etc/ssh/ssh_known_hosts. Use that by default, but fallback to\r\nthe legacy file for lookups if a host is not already known in the former\r\nbut known in the latter.\r\n\r\nMove the determination and setting of the known hosts file into a new \r\nset_knownhosts_file() function, as it is now reasonably complex, will\r\nbe extended further in the future with more sources of known hosts, and \r\navoids handling SSH_OPTIONS_KNOWNHOSTS in multiple different places.\r\n\r\nAdjust the integration tests to the new path and add new tests for \r\ncovering the fallback to the legacy file."},"comment":{"url":"https://api.github.com/repos/cockpit-project/cockpit/issues/comments/284351429","html_url":"https://github.com/cockpit-project/cockpit/pull/6025#issuecomment-284351429","issue_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/6025","id":284351429,"user":{"login":"martinpitt","id":200109,"avatar_url":"https://avatars0.githubusercontent.com/u/200109?v=3","gravatar_id":"","url":"https://api.github.com/users/martinpitt","html_url":"https://github.com/martinpitt","followers_url":"https://api.github.com/users/martinpitt/followers","following_url":"https://api.github.com/users/martinpitt/following{/other_user}","gists_url":"https://api.github.com/users/martinpitt/gists{/gist_id}","starred_url":"https://api.github.com/users/martinpitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinpitt/subscriptions","organizations_url":"https://api.github.com/users/martinpitt/orgs","repos_url":"https://api.github.com/users/martinpitt/repos","events_url":"https://api.github.com/users/martinpitt/events{/privacy}","received_events_url":"https://api.github.com/users/martinpitt/received_events","type":"User","site_admin":false},"created_at":"2017-03-06T09:57:17Z","updated_at":"2017-03-06T09:57:17Z","body":"Some more info about the Atomic failure: on the host `/etc/ssh/ssh_known_hosts` gets written properly, but this is not available to cockpit-ssh that is running in the cockpit ws container. Without this PR, `/var/lib/cockpit/known_hosts` exists in the container as well, as `/var/ is bind-mounted into the container. So `atomic-run` needs to be changed to bind-mount /etc/ssh/ssh_known_hosts too (or just `/etc/ssh/` wholesale, as there's no ssh in the container anyway)."}}
{"actor":{"display_login":"martinpitt"}}